WINNER

Business concept

"You must restart your computer to install these updates." Everyone has seen this message before, and everyone hates it. Rebooting is a disruptive process--and, as a consequence, many system administrators and end-users delay the installation of important updates. Unfortunately, updates correct security vulnerabilities, and a machine that is not up to date is necessarily also a vulnerable one.

Ksplice has developed a solution to this problem: technology that can transform traditional updates into rebootless updates. This technology makes it possible to patch software while it is running, without any disruption or downtime. Software vulnerabilities cost U.S. companies hundreds of billions of dollars per year, according to a study by the Government Accountability Office. This number could be dramatically reduced if system administrators kept software up to date with the latest bug fixes. In fact, the vast majority of security exploit attacks in the wild--greater than 90%--are made possible by systems not being patched with the latest available updates. A solution that makes it possible to deploy updates seamlessly could save companies tens of billions of dollars per year in reduced operational costs and reduced costs from security incidents.

We will sell to software and system vendors (e.g., operating system vendors, telecom and networking equipment vendors, enterprise software application vendors, storage solution vendors) who want the capability of distributing rebootless updates for their products. Ksplice will be paid in three ways: a
license fee, a development fee for transforming each traditional update into a rebootless update, and a small royalty fee for each unit that features this technology.

The opportunity

The demand for this technology is widespread. Devices as disparate as your mobile phone, your set-top box, your desktop and your company's server infrastructure all suffer from the fact that software updates are incredibly disruptive and painful. As computers in their various forms become more
prevalent and pervasive, the need for this solution (and thus the size of the market) only grows.

Operating-system vendors would love to have this capability: being required to reboot a desktop machine leads to a distinctly unpleasant user experience. The case is even more compelling for server operating systems, where reboots lead to lost productivity and missed sales. Manufacturers of routers and other carrier-grade devices also struggle with the same problems as servers, but with even higher uptime requirements. This is true for essentially any product involved in
networking or telecom.

Application vendors themselves also have significant interest in this technology. In general, updating an application requires restarting the application. When this application is a high-performance database, ERP, mail server or CRM system, restarting the application can be quite painful.

This list is by no means exhaustive--we've said nothing of things like virtualization, appliances, storage solutions like SANs, financial transaction-processing systems, appliances or mobile devices. At the end of the day, all updates will be rebootless updates--the notion that one has to restart a device to update it will become absurd. As a consequence, rebootless update technology will become ubiquitous. Just as it is now essentially impossible to purchase a piece of audio equipment that does not feature Dolby technology, we believe that being "Ksplice-enabled" will become the de facto standard for meeting this need.

Competition and alternatives

No other company has successfully pursued rebootless updates because they have not previously been practical. Ksplice's offering is based on completely new technology developed at MIT by the founders. The chief alternative to our rebootless update technology is replication: having multiple redundant copies of a system as a way of achieving fault tolerance. When a component is taken offline for updates, the work associated with that component is shifted over to the remaining components. As a consequence, redundant systems can restart individual components, one at a time, so that the system as a whole does not experience extended downtime. However, Ksplice's solution offers various advantages over replication.

First, for a system to support replication, it typically must be architected from the ground up with replication in mind--an incredibly costly process that can often be intractable for legacy systems. As a consequence, most software does not support it.

Second, our solution requires no interruption of service at all--updates are applied in microseconds, and applications continue to run during the process without disruption. Many redundant systems cause some kind of interruption visible to users of the service, such as in-progress requests failing with an
error. This user-visible service interruption can be a serious problem for many applications.

Third, our solution can reduce operational complexity by eliminating the administrative overhead of preparing for a system reboot. Interacting with redundant systems tends to be burdensome on system administrators, because redundant systems are rarely as simple to administer as a single server.

Finally, replication can be quite expensive: by definition, it involves extra resources that are not fully utilized. This expense is often a serious detractor--replication is virtually nowhere to be found in many industries, in large part because of the cost.

Gaining visibility

It is easy to paint a broad plan of the ubiquitous application of one's solution, but turning that plan into a reality is a completely different story. Using our rebootless update technology, we have developed a subscription service for the Linux operating system. The service automatically delivers the latest vendor-released Linux security and bug-fix updates, in hot update form, to user's machines and installs them automatically. The service is offered for an annual fee based on the number of machines, just like antivirus software or an enterprise software support contract.

Because of the capabilities of the Ksplice technology, this offering does not require advance modification or preparation of the Linux system--so no cooperation or support is required from the OS vendors. In fact, we can even deploy our service without requiring an initial reboot, so it is relatively easy to get immediate sales, since the users can begin reaping the benefits of our technology at any time.

The service has been very popular in the Web-hosting industry, for several reasons. First, the industry is quite fast-moving in its adoption of new technologies and is not change-averse. Second, Linux is quite popular in the industry, as the de facto server operating system of choice, so we can leverage our preexisting implementation. Finally, they understand the problem well: When a new update is announced, a prudent system administrator would immediately install it. Any delay could be particularly painful, since any one of the thousands of users with accounts on the Web host's machines could exploit the vulnerability and cause damage.

However, doing so immediately is rarely an option: Customers are paying the Web-hosting company to keep their Web site up, and unscheduled downtime leads to irate customers at best and contractual violations at worst. Offering this service is desirable for two reasons: First, it is an opportunity for early revenue and a means for bootstrapping the business. Next, it is a means to the end of securing relationships with large vendors. Showing up at the doorstep of a software vendor with a long list of companies that are both our customers and their customers is a straightforward way to demonstrate that their customers want our rebootless update functionality, and that it makes sense to deal with us to enable that functionality on their platform.

Boosting the business

The business is one that is capable of being bootstrapped--after a big publicity push, revenue from the Linux subscription service can make us cash-flow positive and drive future growth. Our biggest bottleneck thus far is actually not technology--it is our ability to sell the software to customers at the rate of demand. Our software is deployed on approximately 10,000 systems, and the
number is constantly increasing. However, we currently only have one full-time employee devoted to marketing and sales, and the demand for the product is beginning to exceed our capacity for managing the sales process and early customer relationship. Leads are not adequately being pursued, and if the
issue is not addressed soon, money will be left on the table. We would use the Forbes prize to address this need and help get us to break even from subscription revenues, in three ways:

First, half of the cash prize will be used to pay for a software developer tasked with automating the customer acquisition and support process. If purchasing the product can be more self-serve, then less human time goes into each sale, the cost of customer acquisition goes down and profits go up. Anyone currently running Linux servers should be able to purchase our rebootless update service just like you can buy a subscription to NetFlix or a song from iTunes, online with a credit card on a Web form.

However, this is not an immediate solution--developing such a system, while technically very straightforward, will take a little time. The rest of the cash will be used as a stopgap measure: bringing on board another salesperson to adequately address customer demand in the interim so that more of our
leads turn into sales.

Finally, once the process is more self-serve and automated, the Forbes advertising component portion of the prize will be used to drive more traffic toward our site and service, ultimately selling more of our software and allowing us to grow the business even further.